{"action":"Upgrade com.vaadin:flow-server to 1.0.11 (1.0.x) or 1.4.3 (1.4.x) or later.","affected":[{"fixed":"1.0.11","introduced":"1.0.0"},{"fixed":"1.4.3","introduced":"1.1.0"}],"component":"com.vaadin:flow-server","cve_ids":["CVE-2019-25027"],"ecosystem":"Maven","epss":0.00668,"exploited":false,"fixed_versions":["1.0.11","1.4.3"],"ghsa_id":"GHSA-rp4x-wxqv-cf9m","id":"tcs_01M5N9C5MXPDGJAMBW103V58YB","modified_at":"2023-11-08T04:01:32.550903Z","published_at":"2021-04-19T14:52:29Z","references":["https://osv.dev/vulnerability/GHSA-rp4x-wxqv-cf9m","https://github.com/vaadin/flow/security/advisories/GHSA-rp4x-wxqv-cf9m","https://nvd.nist.gov/vuln/detail/CVE-2019-25027","https://github.com/vaadin/flow/pull/5498","https://vaadin.com/security/cve-2019-25027"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-rp4x-wxqv-cf9m","url":"https://osv.dev/vulnerability/GHSA-rp4x-wxqv-cf9m"}],"summary":"Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13"}